Privacy Policy

1. Who we are and who this policy covers

This Privacy Policy explains how Darkstorm Ventures LLC, doing business as DonorFinch (“DonorFinch”, “we”, “us”) collects, uses, shares and protects personal information in connection with the DonorFinch service available at donorfinch.com and app.donorfinch.com, our donation forms, our Wix app, our WordPress plugin, our embed script, and our emails (together, the “Service”).

It covers three groups of people:

• Customers — nonprofit organizations that create a DonorFinch account, and the staff and volunteers who use it on their behalf.
• Donors — people who give to a Customer through a DonorFinch donation form, or whose records a Customer stores in DonorFinch (including donors a Customer imports from other systems or records by hand).
• Visitors — anyone who browses our public website.

2. Our role with donor information

When you donate to a nonprofit through DonorFinch, that nonprofit decides what information to ask for and how to use it. In privacy-law terms, the nonprofit is the “controller” (or “business”) of your donor information, and DonorFinch is its “processor” (or “service provider”). We handle donor information only to provide the Service to that nonprofit and as described in this policy and our agreement with them.

If you are a donor and want to access, correct or delete the information a nonprofit holds about you, please contact the nonprofit directly. We will help them respond. If you cannot reach them, email us at privacy@donorfinch.com and we will do what we can.

For Customer account information and Visitor information, DonorFinch is the controller.

3. Information we collect

Information Customers give us

• Account details: your name and email address, the organization’s name, address, website, logo, tax ID (EIN), and settings you choose.
• Team details: the email addresses and roles of people you invite.
• Donor records you add: anything you type, import from a spreadsheet, or sync about donors — names, contact details, giving history, notes, tags, custom fields, households, tasks, and offline gifts such as checks.
• Content you create: donation form settings, receipt and thank-you templates, and saved reports.

Information donors give through a donation form

• Identity and contact details: first and last name, email address, and — if the nonprofit asks for it — phone number and postal address.
• Gift details: amount, currency, one-time or recurring schedule, chosen fund or campaign, whether you covered processing fees, and whether you chose to give anonymously.
• Optional details: tribute information (in honor or in memory of someone, their name, an optional notification email and message) and answers to any custom questions the nonprofit adds to its form.
• Payment details: these go directly to Stripe (see section 5). DonorFinch receives only a summary — for example “Visa ending 4242” and the expiry month — plus Stripe’s identifiers for the payment.

Information we collect automatically

• Technical data: IP address, browser type and version, device type, operating system, language, referring page, and the pages or forms you view, with timestamps.
• Session data: a random session identifier stored in a cookie when you sign in (see section 8), and the browser description of the device that signed in, so you can recognize your own sessions.
• Embed context: when a donation form is shown inside another website, the web address (origin) of that website, so we can confirm the nonprofit has approved it.
• Email delivery data: whether a receipt or sign-in email was delivered or bounced, reported to us by our email provider.
• Activity logs: an audit trail of actions taken inside a Customer’s account (for example who issued a refund, exported a report, or changed a teammate’s permissions) with the time and the user who did it.

Information from other sources

• Stripe: the status and outcome of payments, refunds, disputes and payouts; fee amounts; and the connection status of the nonprofit’s Stripe account.
• Wix and WordPress: when a nonprofit installs our Wix app or WordPress plugin, we receive identifiers for that site (for Wix, the app instance ID and site ID; for WordPress, the site address) so we can connect it to the right DonorFinch account.

We do not ask for, and ask that you do not submit, sensitive information such as government ID numbers, health information, or precise religious or political affiliations, except as a nonprofit may lawfully choose to ask in its own custom questions.

4. How we use information

We use personal information to:

• Provide the Service: display donation forms, process gifts through Stripe, create and email receipts, maintain donor records, run recurring charges, and produce statements and reports.
• Create and secure accounts: send one-time sign-in links, keep you signed in, detect misuse, and maintain audit logs.
• Communicate with Customers about the Service: confirmations, receipts of activity, security alerts, changes to terms or features, and responses to support requests.
• Send emails on a nonprofit’s behalf to its donors: tax receipts, thank-you messages, year-end statements, recurring-gift notices, and tribute notifications.
• Understand and improve the Service: aggregate, de-identified usage statistics such as how many forms were viewed or how long pages take to load.
• Comply with law, enforce our terms, and protect the rights, safety and property of donors, Customers, the public and DonorFinch.

What we do not do. We do not sell or rent personal information. We do not share donor lists with anyone other than the nonprofit they belong to and the service providers below. We do not use donor information to market DonorFinch or anything else to donors. We do not show advertising and do not use advertising trackers.

Legal bases (EU/UK). Where the GDPR or UK GDPR applies, we process Customer account and Visitor information to perform our contract with you, for our legitimate interests in running and securing the Service, and to comply with legal obligations. We process donor information on the instructions of the nonprofit as its processor.

5. Payments and Stripe

All payments are processed by Stripe, Inc. Each nonprofit has its own Stripe account connected to DonorFinch; donations are charged to that account and paid out by Stripe to the nonprofit’s bank. DonorFinch does not hold donor funds.

When you enter card, wallet (Apple Pay, Google Pay, Link) or bank details on a donation form, they are entered into fields served by Stripe and sent directly to Stripe. DonorFinch never receives your full card number, security code, or bank login. Stripe may collect additional information from your device for fraud prevention. Stripe’s handling of your information is described in the Stripe Privacy Policy.

If you choose a recurring gift, Stripe securely stores your payment method so future gifts can be charged on schedule. You can update, pause or cancel through the donor account link in your receipt emails or by contacting the nonprofit.

6. How we share information

• With the nonprofit you give to. Everything you enter on a donation form, and the outcome of your payment, is shared with that nonprofit. It is their donor record.
• With service providers that host, store, send or process information for us, under contracts that restrict their use of it to providing services to us (section 7).
• With Stripe, as described in section 5.
• With platforms a nonprofit connects, such as Wix or WordPress, limited to what is needed to display the form on their site (for example, which form to show and how tall it is).
• For legal reasons: to comply with a law, regulation, subpoena or court order; to enforce our terms; or to protect the rights, property or safety of anyone.
• In a business transfer: if DonorFinch is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify Customers and this policy will continue to apply until changed.
• With your direction or consent, for example when a nonprofit exports a report and sends it to its accountant.

7. Service providers we rely on

We use a small number of established providers. Each only receives what it needs to do its job.

We will update this list when providers change. Customers who need a notice before changes may request one at the contact address below.

8. Cookies

We use cookies only to keep people signed in and to protect the Service. We do not use advertising, analytics or social-media tracking cookies.

Stripe sets its own cookies inside its payment fields to prevent fraud and remember Link users; see the Stripe Privacy Policy. If a nonprofit embeds a form on its own website, that website may use cookies under its own policy. You can delete cookies in your browser settings; doing so will sign you out.

9. Forms embedded on other websites

Nonprofits can place a DonorFinch form on their own website, Wix site or WordPress site. The form loads inside a frame from our domain. We receive the address of the page hosting it so we can check that the nonprofit has approved that website, and we tell the host page how tall the form is and when a gift is complete so it can resize or show a message. We do not read anything else from the host page, and we do not track your browsing on that website.

10. How long we keep information

• Donor and gift records are kept for as long as the nonprofit’s account is active, because they are the nonprofit’s financial records. Nonprofits can delete or archive individual donor records at any time.
• When a nonprofit closes its account, it can export everything first. We then delete or de-identify its data within 90 days, except that we may retain gift, refund and receipt ledger entries for up to seven years where needed for tax, accounting, dispute or legal purposes, and backups for a limited period until they rotate.
• Sign-in links expire after 15 minutes. Sessions expire after 30 days of inactivity.
• Server and email delivery logs are kept for a short period (typically under 90 days) for security and troubleshooting.
• Audit logs are kept for the life of the account because they document who did what with donor data.

11. Security

We take security seriously and use measures appropriate to the sensitivity of the information:

• All connections use HTTPS (TLS). Data is encrypted at rest by our database and storage providers.
• Payment details are handled only by Stripe, which is certified to PCI DSS Level 1. DonorFinch never stores card numbers.
• Each nonprofit’s data is isolated in the database using row-level security, so one organization cannot read another’s records.
• There are no passwords to steal: sign-in uses one-time emailed links, and session tokens are stored only as cryptographic hashes.
• Access inside an account is controlled by roles and permissions, and sensitive actions are recorded in an audit log.
• Donation forms may only be embedded on websites a nonprofit has explicitly approved.

No system is perfectly secure. If we learn of a breach affecting personal information we will notify affected Customers without undue delay and as required by law, so they can inform their donors. To report a security concern, email privacy@donorfinch.com.

12. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. We honor these rights regardless of where you live, to the extent we reasonably can.

• Donors: you can see your gifts, download receipts and manage recurring gifts in your donor account (the link is in your receipt emails). For other requests, contact the nonprofit you gave to; they control your record and can update or delete it. We will assist them.
• Customers: you can edit your account details in Settings, export your data as CSV, and ask us to close your account.
• Email: receipts and other transactional emails are necessary to provide the Service and cannot be switched off while you use it. We do not send marketing email to donors.
• Anyone: email privacy@donorfinch.com. We will verify your identity (usually by replying to the email address on file) and respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights.

13. Regional notices

United States state privacy laws (including California)

In the past 12 months we have collected the categories of personal information described in section 3 (identifiers, contact information, commercial information about gifts, and internet activity; we do not draw inferences or build profiles). We disclose them only to the service providers in section 7 and the nonprofits that collected them. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly collect information from consumers under 16. Residents of California and other states with privacy laws may exercise the rights in section 12, including through an authorized agent, by emailing privacy@donorfinch.com.

European Economic Area, United Kingdom and Switzerland

DonorFinch is based in the United States and primarily serves US nonprofits. If we process your information and you are in the EEA, UK or Switzerland, your information is transferred to the United States. Where required, we rely on standard contractual clauses or equivalent safeguards with our providers. You may lodge a complaint with your local data protection authority.

Canada

We handle personal information in accordance with PIPEDA and applicable provincial laws. You may request access to, or correction of, your personal information using the contact details below.

14. Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

15. Where information is stored

Our application and databases are hosted in the United States. If you use the Service from elsewhere, you understand that your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those of your country.

16. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new effective date, and if the change is significant we will notify Customers by email or a notice in the Service before it takes effect. Continued use of the Service after that date means you accept the updated policy.

17. How to contact us

Privacy questions and requests: privacy@donorfinch.com
General support: support@donorfinch.com

Mail: DonorFinch, 460 King St, Suite 200, Charleston, SC 29403